State-Endorsed Digital Identity Program Amendments

Added specific definitions for 'digital guardian' (including custodial parents and legal guardians) and 'digital wallet' to clarify who can manage identities for others and what tools are permitted.

Established a 'Digital Identity Bill of Rights' granting individuals the right to manage their own digital identity, refuse digital-only identity, and choose what personal data attributes to disclose.

Created a 'duty of loyalty' requiring all program participants (government, providers, verifiers) to avoid practices that exploit individuals or cause them harm.

Strengthened requirements for verifiers and relying parties to process only the minimum necessary identity attributes and to accept presentations from digital guardians.

Updated the effective date of the bill to May 6, 2026, and set a mandatory audit by the Legislative Auditor General to begin in January 2028.

Removed repetitive lists of code section numbers from the header and corrected formatting inconsistencies in the text.

Created a new State-Endorsed Digital Identity Program within the Department of Government Operations.

Repealed previous digital identity statutes (Sections 63A-16-1201 through 63A-16-1203) to allow for the new program structure.

Added a 'Digital Identity Bill of Rights' guaranteeing individuals the right to manage their digital identity and choose physical or digital forms of identity assertion.

Established a Data Privacy Ombudsperson to mediate disputes, review complaints, and report on privacy violations.

Set new eligibility criteria for applicants, including lawful presence in the U.S. and Utah residency.

Deleted specific line-by-line amendments regarding guardianship and identity proofing that were superseded by the new comprehensive chapter.

The definition of 'digital guardian' was updated to explicitly include 'legal guardian of an incapacitated individual appointed under Section 75-5-301,' ensuring adults who cannot manage their own affairs can have a digital guardian appointed for them.

The definition of 'digital identity' was clarified to explicitly state that it does not include electronic records that rely solely on shared authentication information like usernames, passwords, or one-time codes, ensuring the system uses stronger cryptographic verification.

Provisions requiring consent from an incapacitated individual were updated to reflect the new definition of digital guardian, ensuring the correct legal authority provides consent when an individual cannot apply for themselves.

Minor formatting and text corrections were applied to ensure consistency in the description of digital guardian responsibilities and digital identity requirements.

Added a provision to the long title stating the bill provides for coordination with state agencies on use cases for the digital identity program.

Added a provision to the long title stating the bill provides for the repeal of the electronic license certificate or identification card upon sunset review.

Added a provision to the long title stating the bill adds a state-endorsed digital identity as an acceptable form of proof of age.

Added Section 26B-7-501 to the list of amended Utah Code sections, which defines terms related to electronic cigarettes and tobacco retailers.